AliyunServiceRoleForCEN service-linked role for CEN - Cloud Enterprise Network

CEN uses the AliyunServiceRoleForCEN service-linked role to create elastic network interfaces (ENIs) for Enterprise Edition transit router connections.

About service-linked roles

A service-linked role (SLR) is a Resource Access Management (RAM) role linked to a specific Alibaba Cloud service. When a service needs to access other services, an SLR simplifies authorization and prevents errors. Service-linked roles.

Create the AliyunServiceRoleForCEN service-linked role

When you use an Enterprise Edition transit router to connect to a virtual private cloud (VPC), the system automatically creates AliyunServiceRoleForCEN and attaches the AliyunServiceRolePolicyForCEN policy. This policy allows the transit router to create elastic network interfaces (ENIs) in the VPC to transmit traffic to the transit router. The policy contains the following permissions:

Note

If AliyunServiceRoleForCEN already exists, the system does not recreate it.

{
  "Version": "1",
  "Statement": [
    {
      "Action": [
        "vpc:DescribeVSwitchAttributes",
        "vpc:CreateRouteEntries",
        "vpc:DeleteRouteEntries",
        "vpc:DescribeRouteEntryList",
        "vpc:GetVpcRouteEntrySummary",
        "vpc:DescribeZones",
        "vpc:DescribeVpnGatewayAvailableZones"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "ecs:CreateNetworkInterface",
        "ecs:CreateSecurityGroup",
        "ecs:AuthorizeSecurityGroup",
        "ecs:RevokeSecurityGroup",
        "ecs:DeleteSecurityGroup",
        "ecs:JoinSecurityGroup",
        "ecs:DeleteSecurityGroup",
        "ecs:LeaveSecurityGroup",
        "ecs:DescribeSecurityGroups",
        "ecs:AttachNetworkInterface",
        "ecs:DetachNetworkInterface",
        "ecs:DeleteNetworkInterface",
        "ecs:DescribeNetworkInterfaces",
        "ecs:CreateNetworkInterfacePermission",
        "ecs:DescribeNetworkInterfacePermissions",
        "ecs:DeleteNetworkInterfacePermission",
        "ecs:CreateSecurityGroupPermission",
        "ecs:AuthorizeSecurityGroupPermission",
        "ecs:RevokeSecurityGroupPermission",
        "ecs:DeleteSecurityGroupPermission",
        "ecs:JoinSecurityGroupPermission",
        "ecs:DeleteSecurityGroupPermission",
        "ecs:LeaveSecurityGroupPermission",
        "ecs:DescribeSecurityGroupPermissions",
        "ecs:AttachNetworkInterfacePermissions",
        "ecs:DetachNetworkInterfacePermissions",
        "ecs:DescribeDeploymentSets"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": [
        "expressconnectrouter:CreateExpressConnectRouterAssociation",
        "expressconnectrouter:DeleteExpressConnectRouterAssociation"
      ],
      "Resource": "*",
      "Effect": "Allow"
    },
    {
      "Action": "ram:DeleteServiceLinkedRole",
      "Resource": "*",
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "ram:ServiceName": "cen.aliyuncs.com"
        }
      }
    },
    {
      "Action": "resourcesharing:ListSharedResources",
      "Resource": "*",
      "Effect": "Allow"
    }
  ]
}

Delete the AliyunServiceRoleForCEN service-linked role

The system does not automatically delete AliyunServiceRoleForCEN. To delete this role, first delete all VPC connections from the Enterprise Edition transit router:

References

Create a VPC connection